Cloudflared

From ArchWiki

Cloudflared may be used to run a local DNS over HTTPS server (DoH), i.e., a stub resolver.

Installation

Install the cloudflared package.

Usage

Run cloudflared proxy-dns to run a DNS over HTTPS proxy server.

Use the --address and --port options to specify the address and port cloudflared listens to. They default to localhost and 53 respectively. For a list of available command line options, see here.

You can create a systemd service file, for example: 

/etc/systemd/system/cloudflared.service
[Unit]
Description=DNS over HTTPS proxy client
Wants=network-online.target nss-lookup.target
Before=nss-lookup.target

[Service]
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
DynamicUser=yes
ExecStart=/usr/bin/cloudflared proxy-dns --port 5300

[Install]
WantedBy=multi-user.target
Note: The extra package does not provide a service file. See FS#75999.

After starting the service, you can test that it works by using drill(1) (provided by the ldns package): 

$ drill archlinux.org @127.0.0.1 -p 5300

Checking

Use 1.1.1.1/help to check if browser is using Cloudflare DoH.

Endpoints

By default cloudflared uses 1.1.1.1 and 1.0.0.1, the IPv4 addresses of Cloudflare's DNS servers, as upstream endpoint URLs.

You can specify different upstream endpoint URLs with the --upstream option.

As per upstream documentation, the available endpoints are:

Tip: cURL's documentation maintains a list of alternative public endpoints.
Endpoints Description 
https://1.0.0.1/dns-query
https://1.1.1.1/dns-query
https://2606:4700:4700::1111/dns-query
https://2606:4700:4700::1001/dns-query
Standard 
https://security.cloudflare-dns.com/dns-query
Standard, but blocks malware 
https://family.cloudflare-dns.com/dns-query
Standard, but blocks malware and adult content 
https://9.9.9.9/dns-query
Quad9

See also